Missing session confirmation number error..?

Question

Hi All, i'm facing missing session confirmation number error, when i try to add a product to wishlist for logged in user..?
Error :
16:01:57,218 WARN [DAFDropletEventServlet] Missing session confirmation number: Request URI: /store/product/detail.jsp,
Referer: http://localhost:8180/store/jump/productDetail/Food_&_Candy/Candy_&_Chocolate/Licorice/Licorice_Laces_(2_lb._Bag)/52607
Code Fragment:
<dsp:form method="post" action="${wishlisturl}" formid="wishListForm" id="wishListForm" name="wishListForm" >
<dsp:input type="hidden" bean="GiftlistFormHandler.giftlistId" beanvalue="Profile.wishlist.id"/>
<dsp:input bean="GiftlistFormHandler.addItemToGiftlistSucessURL" value="wishlisturl" type="hidden"/>
<dsp:input bean="GiftlistFormHandler.addItemToGiftlistErrorURL" value="wishlisturl" type="hidden" ></dsp:input>
<dsp:input bean="GiftlistFormHandler.quantity" id="wishQty" type="hidden" value="1" priority="9"></dsp:input>
<dsp:input type="hidden" bean="GiftlistFormHandler.productId" value="${productId}"/>
<dsp:input bean="GiftlistFormHandler.catalogRefIds" id="wishlistSku" value="" priority="9" type="hidden"></dsp:input>
<dsp:input type="hidden" bean="GiftlistFormHandler.AddItemToGiftlist" value="submit"/>
</dsp:form>
Please explain why the error being thrown..
Thanks,
Vishnu

Answer 1

Usually you should not get this unless the same form is getting submitted multiple times or outside current session's context. I have also seen this happening sometimes when submitting dsp forms through AJAX. You may check these possibilities.
Actually ATG uses a request parameter dynSessConf* whose value is a session-confirmation number to verify that the incoming request to ATG is legitimate. On submission of a form or activation of a property-setting <dsp:a> tag, DAFDropletEventServlet in request pipeline checks the value of dynSessConf against the current session's confirmation number. If it detects a mismatch or missing number, it can block form processing and return an error. This mechanism is provided to prevent cross-site scripting attacks and you can configure this behavior through following properties in /atg/dynamo/Configuration:
enforceSessionConfirmation - specifies whether the request-handling pipeline requires session confirmation in order to process the request; the default value is true.
warnOnSessionConfirmationFailure - specifies whether to issue a warning on a confirmation number mismatch; the default value is true.
You can also control session confirmation for individual requests by adding the requiresSessionConfirmation attribute to true or false on the <dsp:form> or <dsp:a> tag like:
<dsp:form requiresSessionConfirmation="false" ...>
<dsp:a requiresSessionConfirmation="false" ...>
When requiresSessionConfirmation attribute is set to false as above, the _dynSessConf parameter is not included in the HTTP request and DAFDropletEventServlet skips validation of this request's session-confirmation number.